Personal data can continue moving freely between the European Economic Area and the United Kingdom until at least 2031 after the European Commission renewed two adequacy decisions governing these transfers.
These adequacy decisions, first adopted in 2021, confirm that the UK's legal framework for data protection offers safeguards broadly equivalent to those in the European Union, the Commission stated in a release on Friday.
EEA refers to European Union countries plus Iceland, Liechtenstein, and Norway. Personal data covers information that identifies individuals, such as names, addresses or financial details.
The renewal of the decisions follows an assessment process, including an opinion from the European Data Protection Board and approval by EU member states.
The decisions apply under both the General Data Protection Regulation — known as GDPR — and the Law Enforcement Directive, which regulates data handling by police and other authorities.
Six-year validity
The Commission confirmed the decisions will remain in force until 27 December 2031, with a possible renewal after that date.
They include a review point after four years to assess how the arrangements are working.
The updated decisions follow a prior six-month extension that allowed for a reassessment of UK data laws.
By renewing these adequacy decisions, the Commission enables personal data transfers to continue without extra checks or authorisations for organisations operating across borders.
